Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.39. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:12069

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.18.39 bug fix and security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. 

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: go-toolset:rhel8 security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Search: CVE-2025-61731